generate-youtube-thumbnail

Pass

Audited by Gen Agent Trust Hub on Sep 13, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied assets, such as brand logos and character photos, as well as text prompts for generation.\n
  • Ingestion points: Reference images in the references/ directory and prompt strings configured in the scripts/generate-batch.sh script.\n
  • Boundary markers: While the script does not implement technical boundary markers, the documentation provides templates and a 'CRITICAL CHARACTER LIKENESS' block to guide the model's interpretation of external data.\n
  • Capability inventory: The script utilizes curl for network interactions and python3 for image processing and JSON data handling.\n
  • Sanitization: The implementation uses shlex.quote to sanitize dynamic headers retrieved from the API before they are used in a shell eval context, mitigating command injection risks.\n- [DYNAMIC_EXECUTION]: The scripts/generate-batch.sh script uses eval to construct and execute curl commands for image uploads, using dynamic headers provided by the Novoads API. It also executes embedded Python logic at runtime to perform image resizing (via Pillow) and to process JSON payloads.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 13, 2026, 11:13 PM